High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Audio/Video: Playback component
ComponentDOM
Bug ClassLogic Error
Tracker2079061
Fix commit9f8119a9bf91 (firefox) +5/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
dom/media/mediaelement/HTMLMediaElement.cpp
modified

Files Changed

  • dom/media/mediaelement/HTMLMediaElement.cpp
  • dom/media/webvtt/TextTrackManager.cpp
diff --git a/dom/media/mediaelement/HTMLMediaElement.cpp b/dom/media/mediaelement/HTMLMediaElement.cpp
index 4d8fca7a7ed..23a897cae83 100644
--- a/dom/media/mediaelement/HTMLMediaElement.cpp
+++ b/dom/media/mediaelement/HTMLMediaElement.cpp
@@ -3800,6 +3800,7 @@ void HTMLMediaElement::Pause(ErrorResult& aRv) {
 }
 
 void HTMLMediaElement::PauseInternal() {
+  RefPtr<HTMLMediaElement> kungFuDeathGrip(this);
   if (mDecoder && mNetworkState != NETWORK_EMPTY) {
     mDecoder->Pause();
   }
@@ -6914,6 +6915,8 @@ void HTMLMediaElement::ChangeReadyState(nsMediaReadyState aState) {
     return;
   }
 
+  RefPtr<HTMLMediaElement> kungFuDeathGrip(this);
+
   nsMediaReadyState oldState = mReadyState;
   mReadyState = aState;
   LOG(LogLevel::Debug, ("{} Ready state changed to {}", fmt::ptr(this),
@@ -7789,6 +7792,7 @@ bool HTMLMediaElement::ShouldQueueTimeupdateAsyncTask(
 
 void HTMLMediaElement::FireTimeUpdate(TimeupdateType aType) {
   NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
+  RefPtr<HTMLMediaElement> kungFuDeathGrip(this);
 
   if (ShouldQueueTimeupdateAsyncTask(aType)) {
     RefPtr<nsMediaEventRunner> runner =
diff --git a/dom/media/webvtt/TextTrackManager.cpp b/dom/media/webvtt/TextTrackManager.cpp
index 8dd326aaa04..61d72676dd9 100644
--- a/dom/media/webvtt/TextTrackManager.cpp
+++ b/dom/media/webvtt/TextTrackManager.cpp
@@ -591,6 +591,7 @@ void TextTrackManager::DispatchTimeMarchesOn() {
 // https://html.spec.whatwg.org/multipage/embedded-content.html#time-marches-on
 void TextTrackManager::TimeMarchesOn() {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
+  RefPtr<TextTrackManager> kungFuDeathGrip(this);
   mTimeMarchesOnDispatched = false;
 
   CycleCollectedJSContext* context = CycleCollectedJSContext::Get();
Loading diff…